JP5736511B2 - Zero sign-on authentication - Google Patents

Description

  The present invention facilitates user access to media services without requiring the user to sign on or enter a password as part of the authentication procedure required before granting access to the media service. About that.

  People who purchase goods and services using the Internet typically have to verify their identity at each store, whenever the store website is accessed or any other time service is required. The customer may need to complete a sign-on procedure for entering a username and password. With more and more stores relying on online services, customers may need to record multiple combinations of usernames and passwords, one for each website, all of which are user Burden. In addition, the user name and password of the user may be stored in so many different locations that there is a risk of theft of personal information. Therefore, it is necessary to limit the number of sign-on operations that the user must perform and / or the number of places where the user's username and password combination is stored.

  The invention is pointed out with particularity in the appended claims. However, other features of the present invention will become more apparent and best understood by reference to the following detailed description taken in conjunction with the accompanying drawings.

1 illustrates a zero sign-on system contemplated by one non-limiting feature of the present invention.

FIG. 4 shows a message exchange diagram of a zero sign-on message exchange intended by one non-limiting feature of the present invention.

FIG. 4 shows a message exchange diagram of an address assignment message exchange intended by one non-limiting feature of the present invention.

FIG. 4 shows a flowchart of a method for supporting a zero sign-on procedure intended by one non-limiting feature of the present invention. FIG. 4 shows a flowchart of a method for supporting a zero sign-on procedure intended by one non-limiting feature of the present invention.

Fig. 3 shows a flowchart of certificate provisioning as contemplated by one non-limiting feature of the present invention.

FIG. 4 shows a flowchart of a method for supporting a zero sign-on procedure intended by one non-limiting feature of the present invention.

  As required, detailed embodiments of the present invention are disclosed herein; however, it is understood that the disclosed embodiments are merely exemplary of the invention, and that the invention can be embodied in various and other forms. Should. The drawings are not necessarily to scale, and some features may be enlarged or reduced to show particular components in detail. Accordingly, the specific structural and functional details disclosed herein are not to be construed as limiting, but merely as a representative basis for teaching one of ordinary skill in the art to make use of the invention in various ways. It is.

  FIG. 1 illustrates a zero sign-on system 10 contemplated by one non-limiting feature of the present invention. The system 10 supports zero sign-on access to all types of media services suitable for multiple user devices 12. For exemplary purposes, a single mobile user device 12, eg, a mobile computer, a phone, a tablet, a PDA, etc., can provide IP-based services by signaling exchange with first and second service providers (SP) 14,16. To access. User device 12 includes, but is not limited to, a set-top box (STB), a media terminal adapter (MTA), and a media player. User device 12 may include a client application implemented on a computer readable medium, which, when executed by the processor to support zero sign-on, allows the processor to A plurality of instructions including an instruction for easily performing an intended operation is stored.

  The client application may be configured to provide a user / subscriber interface or otherwise support interaction with a service provider 14 of a CATV station operator (MOS). It can be a common web browser, such as Internet Explorer or Firefox, or it can be a custom application or any corresponding type of operating system. The client application can be configured to run on any type of device 12, such as a PC, laptop or smartphone. Although the first location 22 of the user device 12 is shown to correspond to the home or other location of the user who subscribed to the service of the first service provider 14, it is the user's home associated with the user device, Alternatively, it may be the home of another person who happens to apply for service from the same first service provider 14. The second location 24 corresponds to another location where the user device 12 has changed location, for example a Wi-Fi hotspot, where the second service provider 16 is the user device 12 is the first service provider 14. It is necessary to support at least part of the signaling required to access the services.

  In a first location 22, the user equipment 12 is connected to a cable modem (CM) 30 that facilitates data exchange with a service provider cable modem terminator (CMT) 32. The cable modem 30 and the CMT 32 cooperate to enable bidirectional high-speed data access according to the Data Over Cable Service Interface Specification (DOCSIS) via the cable network 34. The cable modem 30 can be installed in the subscriber's home and can be incorporated into a VoIP device (eMTA) or set top. CMT 32 may be a central manager associated with service provider 14 that controls network access. The trusted domain 38 of the service provider 14 typically includes a plurality of CMTs 32, the cable modems 30 they support, and other devices 40 that they manage to facilitate media service interaction with their subscribers, 42 and 43.

  The second service provider 16 is not shown to include a trusted domain, but may include such a trusted domain as well. The trusted domain of the second service provider 16 is not shown because the user device 12 is not a subscriber to the second service provider 16 and may therefore be an untrusted user device. The service providers 14, 16 are configured to simultaneously support communication between trusted and untrusted user devices, i.e., more specifically between access points used by those devices to communicate with the service provider. be able to. When the user equipment 12 is in the first location 22, the cable modem 30 and / or CMT 32 functions as an access point, and when the user equipment 12 is in the second location 24, a wireless router or other gateway (not shown). ) Functions as an access point. Since the access point at the second location 24 is not within the trusted domain 38 of the first service provider 14, it is considered an untrusted access point for the first service provider 14 (it is the second service It can be a reliable access point for the provider 16).

  The present invention primarily describes supporting access to media services provided by satellite, broadcast and cable television service providers, high-speed data service providers, and telephone service providers, but the signals from the service providers Its intended use by all types of media services based on communication is also fully intended and, optionally, the service provider is also able to communicate signals to different locations and to different types of user equipment. To illustrate one beneficial feature of the present invention, regardless of the location of the access point (eg, reliable and unreliable) used to facilitate communication of the user equipment 12 and associated signaling, the user equipment 12 As long as it supports IP streaming of TV programs to, one exemplary embodiment of providing TV services will be described. Television services can include subscriber-specific services such as personal video recording (PVR), premium channels, etc., and non-subscriber-specific services such as broadcast programs, viewer-produced programs, and the like.

  Television signal streaming may be supported by CMT32 for cable-based communication systems or by some other similar devices for satellite, high-speed data and telephone-based service provider system configurations. it can. Provider 14 may include servers, headend units or other devices that support television programs, pre-recorded video (VOD, PVR, etc.) and other media content (video games, web pages, etc.) Are then packaged and transmitted to one or more access points (gateways). US patent application Ser. No. 12 / 650,664 filed Dec. 31, 2009 includes a cable modem or other network configured to support message communication between CMT and local user equipment. A similar system is disclosed that facilitates zero sign-on based on trust status with the access portion, the disclosure of which is hereby fully incorporated by reference.

  The provisioning database 42 can be associated with the first service provider 14 and included in the trusted domain 38 to facilitate rules of media services that the user device 12 can obtain and / or purchase. The provisioning database 42 may include information regarding the level of service or type of service paid for by the subscriber. The provisioning database 42 can also maintain a list of IP addresses assigned to client applications associated with the cable modem 30, for example, when a subscriber allows multiple user devices to connect to that cable modem. Each of their user equipment can be assigned a unique IP address within the corresponding CMT 32 subnet. Optionally, each assigned IP address may be associated with a MAC address assigned to the support cable modem 30 to facilitate associating the IP address with a particular cable modem 30 and / or subscriber. it can.

  Although the first location 22 is shown to support DOCSIS-based communications, the present invention is not intended to be so limited and the service providers 14, 16 may be mobile phones or other It is fully intended to be configured to virtually support all other types of communications, including communications relating to wired / wireless telephones. Service providers 14, 16 can be configured to facilitate virtual access to any type of electronic media or media services / content. When the subscriber wants to access the content, the subscriber can instruct the client application to request it from the service provider 14,16. The service provider 14, 16 may require that the user equipment 12 and / or their subscribers be authenticated before allowing access to the content via either a trusted or untrusted access point. And can check if they are allowed the requested access.

  FIG. 2 shows a message exchange diagram 50 of messages that can be exchanged to facilitate zero sign-on as intended by one non-limiting feature of the present invention. The service provider 14 sends an authentication request to the client application to authenticate the request from the user device 12, the client application forwards the authentication request to the identity provider (IdP) 40, and the service provider 14 Can wait for a response containing an assertion indicating that is authenticated. The response can also include some authentication information. The IdP 40 may be a centralized subscriber authentication entity within the trusted domain 38 of the service provider 14 and / or having a trusted third party (not shown). The IdP 40 can provide an assertion token to the service provider 14 that can be used to authenticate the subscriber and make a content access decision when requested by the service provider 14. The IdP 40 is composed of an IP subnet used by the DHCP server 43, and can assign an IP address to a client application in the MOS trusted domain / network.

  If the service provider 14 does not know the subscriber's IdP 40, it can prompt the subscriber for it. If the service provider 14 needs further authentication data after the subscriber is authenticated, the service provider 14 can issue the request directly to the MOS authentication server (not shown). The service provider 14 can be located anywhere, for example in the first and second locations 20,22. It can be located at the back end of the MSO network or at the gateway device (IPS). It can also be located on an external website. The service provider 14 can be considered anywhere where the client application connects and requests services / content.

  One non-limiting feature of the present invention does not require a username and password to log in, and allows zero sign-on for subscribers accessing services and content on different websites (MSO and vendor). Is intended. This is done by leveraging the existing security infrastructure of the cable network or other type of network associated with the service provider 14. When the client application requests content from the service provider 14, the request can be forwarded to the IdP 40 for authentication. When the IdP 40 receives the authentication request transferred from the client application, the IP source address (for example, the IP address assigned by the access point) is within the IP address subnet of the MSO for the client device 12 (for example, its trust). It can be confirmed whether it is in the domain 38).

  If the IP source address is in the trusted domain 38, the IdP 40 queries the provisioning system 42 for the subscriber information ID using the IP source address. The IdP 40 can then generate an assertion response and send it to the service provider 14. Importantly, this authentication can be done without prompting the subscriber for authentication information (user name and password). The service provider 14 can authorize the client application to access the content after verifying the assertion token. IdP 40 authenticates subscribers using their authentication information (username, password) unless the client application has a valid security context if the forwarded authentication request does not come from the MSO network. Will be required to do.

  After authenticating the client application using zero sign-on, the IdP 40 can establish an authentication session, i.e., a security context, with the client application and generate a time-limited token, i.e., a cookie, Saved. When the service provider (any SP) has the client application forward the authentication request back to the IdP 40, the IdP 40 does not need to prompt the subscriber if the cookie is still valid (not expired) and immediately In response to an authentication assertion. Optionally, as long as the client application has a valid authentication session cookie, it can connect to any service provider 14, 16 in the same trust ring as the IdP 40 and log in to that subscriber with authentication information. There is no need to request that. This is independent of the access network used, which means that subscribers move their client applications from the cable network to other access networks and connect to service providers 16 in different domains and still have zero sign-on functionality Means that you can continue to enjoy

  The IdP 40 queries the provisioning system 42 for subscriber information using the client application's IP source address to generate an appropriate assertion response. FIG. 3 shows a message exchange diagram 60 for determining a subscriber associated with an IP source address based on one non-limiting feature of the present invention. When the client application requests an IP address, the CMT 32 inserts the MAC address of the subscriber's cable modem 30 that the service provider 14 knows and trusts into the request and then forwards the request to the DHCP server 43. After assigning an IP address to the client application, the DHCP server 43 can notify the provisioning system 42 and indicate which cable modem 30 is associated with the MAC address. The DHCP server 43 can also notify the provisioning system 42 when an IP address is no longer associated with a given cable modem's MAC address (expires or is assigned to another device). Accordingly, the provisioning system 42 can generate a mapping of the client application IP source address associated with the subscriber's cable modem MAC address.

  Once the cookie expires, the client application needs to be re-authenticated, but that authentication can be done automatically when the client application is connected to the cable network again (zero sign-on). If the client application cannot connect to the cable network before the cookie expires, the IdP 40 prompts the subscriber for authentication information (user name and password) to resume the authentication session token (single sign-on). be able to. Cookies can be provisioned to last for a specific period of time, such as 1 day, 1 week, 1 month, 6 months, before needing to be refreshed. Use of cookies in this way facilitates zero sign-on access to websites or other service provider portals used by subscribers to access media for that period of time without requiring subscribers to sign on. Can do. The cookie can be stored on the computer readable media of the user device 12 and any user with the user device 12 can receive access to the corresponding media service.

  One non-limiting feature of the present invention is intended to enhance security authentication information (e.g., tokens, cookies, etc.) stored on the user device 12 rather by storing certificates. The certificate is stronger than the user name and password authentication information. Passwords are too simple and hackers can easily guess, ie they are vulnerable to dictionary attacks. They can also be shared with friends, resulting in unauthorized access to the service. Digital certificates are not subject to these vulnerabilities and provide a high level of subscriber authentication. Subscribers can also experience zero sign-on once they have installed a digital certificate on their device, using a digital certificate instead of a username and password to authenticate the subscriber .

  One challenge with subscriber digital certificates is to install them on the subscriber's device 12 in a secure manner. One way is to have the subscriber download and install a certificate manager application to generate a certificate signing request (CSR) and send it to the certificate issuing server. The certificate issuing server needs to authenticate the subscriber and can then issue a certificate. If only the user name and password are used, the authentication strength enhanced by the certificate is lost. Security is simply as strong as its weakest link. A stronger form of subscriber authentication is to control the issuance of digital certificates.

  Supporting two-factor subscriber authentication suitable for issuing subscriber certificates using the DOCSIS network 34 or other types of networks described above (eg, a cellular network between an access point and a service provider). it can. A certificate issuing server (eg, IdP 40, CMT 32, or other element of the trusted domain 38 of a particular service provider 14) can perform two-factor subscriber authentication by performing the following steps: Verify whether the subscriber has a valid username and password, for example by requiring the subscriber to perform a single sign-on; 2-CSR request is the source IP address, ie authentication of the subscriber It is verified whether it has a source IP address associated with the cable modem 30, for example, based on an address guarantee procedure described below. If both of these verification steps are successful, the subscriber's authentication level should be strong enough for the certificate issuing server to issue a certificate to the subscriber's device.

  The certificate may include the subscriber's name, i.e. the username and MAC address of the user equipment, the access point, and / or the CMT 32. Inclusion of the MAC address can help prevent certificates from being shared across devices. Once the certificate is installed on the user device 12, when the user device 12 accesses a service or content on the Internet, the user device 12 is automatically used using the certificate without using a user name and password. Can be authenticated. The Cable Lab OLCA specification is how cable TV operators and their partners use SAML federated single sign-on authentication to subscribers and their video content online using their cable TV operator account credentials. The disclosure of which is fully incorporated herein by reference. Subscribers are usually authenticated by username and password, but can use certificates to experience zero sign-on.

  When subscribers connect to a cable TV operator's site for authentication, zero sign-on is achieved by a mutually authenticated Transport Layer Security (TLS) connection on their home network or on an external network can do. Certificates can be automatically exchanged between the server and the client. If the certificate validation is successful, the server responds with a SAML assertion transfer command, which sends the subscriber back to the service provider for assertion validation and access to the requested content / service. Certificates provide a high level of authentication, so the above mentioned cookie need not be renewed as often as once every six months or more, for example. When a certificate needs to be renewed, for example after a period of one year, the certificate manager application connects to a certificate issuing server and installs a new certificate. If the existing certificate has not yet expired, both a valid certificate and the subscriber's username and password can be used for two-factor authentication, so certificate renewal is on the home network or outside the home network Can happen at. If the existing certificate has expired, certificate renewal needs to occur on the home network to provide two-factor authentication to the certificate issuing server, as described in Initial certificate issuance .

  As supported above, the present invention provides a zero sign-on procedure that stores trusted authentication information (eg, a cookie or certificate) on user device 12 to facilitate access to automatic zero sign-on authentication and media services. Intended. FIG. 4 shows a flowchart 70 of a method for supporting a zero sign-on procedure using both cookies and certificates, described in accordance with one non-limiting feature of the present invention. Although using one or more of cookies and certificates will be described, the present invention is based solely on procedures related to one of cookies and certificates, i.e., using only cookies or certificates alone. It is fully intended to facilitate a similar zero sign-on procedure for the desired environment.

  In block 72, the user device is connected to the access point for the first time or before the cookie or certificate is assigned, eg, when the user device is first deployed. The access point is a cable modem or similar edge type device to which a router or other gateway is connected to facilitate wireless communication with one or more user devices for exemplary non-limiting purposes. , Mainly explained. However, the access point does not have to be a device, for example, and in particular does not have to be a device whose connection is controlled locally by the operator. The access point may be the CMT or other interface to one of the service provider support networks.

  An illustrative example is shown for a particular scenario where a user equipment connects to a local wireless router and the wireless router informs the service provider via a cable modem and CMT, where the intended zero is shown. Sign-on can help the subscriber to continuously access services as the subscriber's user equipment moves between trusted and untrusted access points. This is likely to happen mainly when user equipment moves in a wireless network, i.e. they are supported by a wireless router. Of course, cellular networks and / or broadcast networks may not include routers as access points, but rather rely on other devices, such as but not limited to macrocells, microcells, picocells or femtocells. The present invention fully contemplates zero sign-on procedures applied to these other types of access points and corresponding communication media.

  In block 74, it is determined whether the connected access point is reliable. An access point can be considered as one of trusted or untrusted depending on whether the user equipment is in the trusted domain of the service provider attempting to access the media service. This determination may require the user equipment to identify the media service that it attempts to access, or identify the service provider for which the service is requested. One test of reliability can be based on the IP address assigned to the user equipment when requested to access the media service. If the IP address is within the trusted domain of the service provider's IP address, eg, within one IP subnet of the service provider's trusted CMT, the access point can be trusted, otherwise it can be considered untrusted. .

  Since it may not be desirable to initially provision the user equipment with trusted credentials (ie, one or both of cookies and / or certificates) via an untrusted access point, block if the access point is untrusted Return to 72. Optionally, at block 76, the user is given the option of accessing the requested media service by entering their username and password through a sign-on operation. If the user name and password are verified, the user can legitimately access the media service before being provisioned with the trusted authentication information.

  At block 78, the access point is trusted to determine where the sign-on operation has been performed. The sign-on operation may be an optional step in which the subscriber determines whether to provision the user equipment with a cookie and / or certificate as trusted authentication information. Optionally, rather than allowing the subscriber to make a decision, the service provider may require a specific action and / or service provider in that the subscriber may be forced to sign on. Can automatically enforce cookie provisioning based on, for example, subscriber contract obligations and / or subscriber behavior (e.g., the subscriber and user equipment are performing inappropriate actions or If so, it can prevent more secure and long-term certificate provisioning).

  In blocks 80 and 82, the user equipment is provisioned with one or both of cookies and certificates. The certificate may require transmission to the access point via in-band signaling or via a dedicated portion of the server provider's trusted domain to increase the security of its transmission. Cookies can be transmitted in a similar manner, and / or cookies can be transmitted via out-of-band signals or over the Internet, as their security is less important, eg, cookies are secured sockets It can be transmitted over a layer (SSL) pipe. In-band signals occur between known endpoints and SSL pipes are not required, so SSL pipes are less secure than in-band signals.

The above portion of the zero sign- on method can be generally referred to as the provisioning stage in that the user device is provisioned to store one or both of cookies and certificates. However, this stage is optional if the user equipment is already provisioned with trust credentials, for example upon purchase or installation (preferably installation by an authorized trusted agent of the service provider). Can be avoided. The next part of the flowchart can be generally referred to as an authentication phase, where the user equipment is authenticated, possibly by a zero sign- on operation, and accesses the media service based on the stored trusted authentication information.

  At block 84, a request for media service from the user device is determined. This determination may be the same as described above in block 72 regarding connecting the user equipment to the access point. Block 84 is shown briefly to illustrate the beginning of the authentication phase, but can be skipped if sufficient determination has already been made. Block 84 may be activated as soon as a request to access a media service is issued, for example, when a user device accesses a website to request content from a particular service provider. Also, other activation events may be equivalent to determining whether the user device needs to be authenticated, for example, power on the user device “on”, input of “send” when dialing a phone number (For example, for authentication of cellular access).

In block 86, it is determined whether the access point used by the user equipment when requesting access to the media service is a trusted access point. Determining whether the access point is reliable is fully described herein, and if already determined at block 74, block 86 can be skipped accordingly. At block 88, a trusted / untrusted determination is used to distinguish whether trusted authentication information is required to facilitate zero sign- on. As described in further detail below, one non-limiting feature of the present invention is intended to facilitate zero sign- on without relying on trusted authentication information, for example, based on the trusted state of the access point. doing.

  At block 88, the access point determines whether it can be trusted. This may be the case, for example, when the user device is connected to the home access point of the subscriber associated with the user device, i.e. the person who has been authenticated as the user device owner and / or the access point is the owner of the user device. If the user device is located in another home or other location that is associated with someone other than that and the corresponding access point is still in the service provider's trusted domain, for example, the subscriber This can happen if you take it there and connect to a fellow access point.

  Also, in block 88, the next stage of the authentication stage is distinguished depending on whether the trusted authentication information stored in the user device is a cookie and / or authentication information. If both types of trusted credentials are stored on the user device, either one, for example, the most secure certificate, either automatically by the user or automatically by the client application used automatically You can choose. However, as an option, certain access points and / or media services can indicate the trusted authentication information to use, for example, certain websites may facilitate the use of cookies rather than certificates. .

At block 90, performing a certificate-based zero sign- on operation, the user device accesses the media service associated with the certificate that is authenticated and stored therein. When multiple certificates are stored, for example when the user equipment is used by different subscribers, the user equipment does not require user interaction to maintain the zero sign- on function, eg, the user equipment The client application can be configured to automatically select a certificate by selecting a certificate corresponding to the user's identity, as determined by current and past operating characteristics and performance, ie, the client application Does not need to enter information, can identify a user, and can automatically select a certificate associated with that user.

At block 92, performing a cookie-based zero sign- on operation, the user device accesses the media service associated with the authenticated and stored cookie. When multiple cookies are stored, for example when the user device is used by different subscribers, the user device does not require user interaction to maintain the zero sign- on function, eg, the user device's current And by selecting a cookie corresponding to the user's identity, as determined by past operating characteristics and performance, the client application can be configured to automatically select the There is no need to enter, the user can be identified, and the cookie associated with that user can be automatically selected.

  Optionally, the cookie may have a relatively small amount of data, or otherwise it is not configured to specifically identify the user and / or the user's credentials for the media service. This may have been done to improve the processing requirements and / or backend behavior required to classify a large number of user cookies. Rather, cookies can be used simply to indicate a trusted entity, such as a user device, which is considered trusted if it has cookies, even if not specifically verified.

  Optionally, if the service provider is willing to accept the fact that the user device is connected to a trusted access point as sufficient evidence of its authenticity, the use of cookies in block 92 can be omitted. This scenario can be used to facilitate all home access to the same type of content, for example, in a traditional television broadcast scenario, all television receivers in the home can be connected to an access point. The same content for any authorized device can be accessed. As a further option, cookies may be at least partially used in the same way that STB or DVR is required to access specific television signals that are not available on all television receivers in the same home, for example. Based on this, access to a specific media service can be permitted.

  Matching MAC addresses, for example, if it is desirable not to use cookies, or to avoid performing other actions to identify user devices and / or users, where cookies used do not self-identify and / or Authenticated / media permissions for the user device, rather than by performing some other mapping operation, may rather be those associated with the access point. The service provider may already be associated with the billing address and other media permissions for the access point, so that those same permissions are relatively simple, i.e. extra MAC addresses that do not need to be performed or It can be expanded to user devices without performing IP address matching.

At block 94, if the user device uses and / or stores the cookie, the cookie is refreshed. The expiration date of the cookie can be extended beyond the expiration date specified in its last provisioning using refresh. When using cookies at a relatively high frequency and on a reliable basis, rather than disrupting service, the cookies may be automatically refreshed to maintain continuity of zero sign- on. This can be useful for maintaining zero sign- on functionality for users who frequently access the same website and / or media service.

  Returning to block 86, if it is determined that the access point is not trusted, proceed to block 96 to determine which of the trusted authentication information to use. For example, if the user took the user device to a Wi-Fi hotspot outside the trusted domain of the service provider instead of taking the user device to a fellow home network, proceed to block 96. The trusted authentication information selected at block 96 can be determined by the same procedure as at block 88. If a certificate is used, the procedure of block 90 is used to facilitate access to the media service. Certificate provisioning is done in a more restrictive way than cookies, so ignoring the untrustworthiness of an access point can be tolerated by service providers when considering relatively reliable certificates. .

If the user device does not include a certificate, or if the stored certificate is not used as part of the authentication procedure, it is determined at block 98 whether the cookie is valid. Cookies can be valid for a limited period of time, as described above. If the cookie is invalid, block 100 requests the user to complete a sign- on operation so that access to the media service is permitted. If the cookie is valid, at block 102, zero sign- on is performed, for example, in the same manner as block 92. Optionally, because the access point can be trusted, it requests to perform zero sign- on using a cookie in block 102, as opposed to block 92 which allows zero sign- on without relying on cookies. May be. After the access point becomes untrusted, block 94 may be omitted to force the user device to connect to the trusted access point before allowing refresh.

As described above, the zero sign- on function can be supported using the IP source address. The present invention is intended to perform an address assurance procedure that ensures that an IP address has been verified and not spoofed, i.e., has not been tampered with. Optionally, the zero sign- on contemplated by the present invention can be based on the MAC address of the DOCSIS cable modem (access point) and the IP source address of the client application.

  Cable modem MAC address spoofing or cloning can be blocked by: DOCSISBPI + enforcement, BPI + uses a digital certificate to authenticate the CM, including MAC address authentication (DOCSIS3.0 uses BPI + Provide the enforcement function, the disclosure of which is fully incorporated herein by reference); MAC address domain authentication, where only the cable modem provisioning system operates in the CMT MAC address domain in which the cable modem is authorized If a hacker attempts to clone a MAC address and use it in a different MAC address domain, the provisioning system will block it (Note: CMT will duplicate the MAC address of the same domain) To prevent).

  IP address spoofing can be prevented by: required to block traffic from outside the MSO's trusted domain (eg, external network (Internet)) with the source IP address in the MSO's client subnet. Router configuration (cable modem / access point to which the device is connected); source address verification, where client applications on the MSO network are allocated by the MSO provisioning system (DOCSIS 3.0 provides this functionality) Only specified IP addresses can be used.

  While exemplary embodiments have been described above, these embodiments do not represent all possible forms of the invention. Rather, the language used in the specification is language of description rather than limitation, and various changes can be made without departing from the spirit and scope of the invention. Further, various features that implement the embodiments can be combined to form further embodiments of the invention.

Claims (8)

A method for facilitating zero sign-on access to media services,
Providing trust authentication information via a first access point to a client application running on the user device, wherein the trust authentication information defines media service permissions for the user device, and the first access point is trusted Possible steps,
Allowing zero sign-on access of the user equipment to the media service via a second access point based on the media service authorization defined in the trust authentication information,
If the second access point is not reliable,
i. If the trusted authentication information is not expired when provided via the second access point, permit zero sign-on access to the media service in the first stage via the second access point;
ii. If the trusted authentication information has expired when provided via the second access point, permit sign-on access to the media service in a second stage via the second access point;
When the second access point is reliable,
i. If the trusted authentication information is not expired when provided via the second access point, permit zero sign-on access to the media service in the third stage via the second access point;
The third stage includes a number of the media service than the first stage, the first stage seen contains many of the media service than the second stage,
After the trust authentication information is provided to the user device via the first access point, a first television program is streamed over the Internet to a third access point;
Determining whether the third access point is trusted or unreliable;
Allowing the user device to provide zero sign-on access to the first television program via the third access point in response to the user device notifying the first request via the user device;
And the step of permitting comprises:
i. If it is determined that the third access point is reliable, the user apparatus can be accessed to the first television program without requiring the user device to provide the trust authentication information via the third access point. Allowing zero sign-on access;
ii. If it is determined that the third access point is not reliable, zero sign-on access to the first television program when the user device provides the trust authentication information via the third access point Allow step and
Including
After the trust authentication information is provided to the user device via the first access point, a second television program is streamed to a fourth access point via the Internet;
Determining whether the fourth access point is one of trusted and untrusted;
Allowing the user device to access the second television program via the fourth access point in response to the user device notifying the second request via the user device;
And the step of permitting comprises:
i. When it is determined that the fourth access point is reliable, or when it is determined that the fourth access point is unreliable and the user apparatus provides the trust authentication information via it, Allowing zero sign-on access to two television programs;
ii. If the user of the user device enters a sufficient username and password combination close to the time when the request for the second television program is informed via the fourth access point, the fourth access Allowing sign-on access when it is determined that the point is untrusted and the trust authentication information is expired when supplied from the user device via the fourth access point;
Including methods.   The method of claim 1, further comprising associating the media service authorization with a subscriber associated with the access point. 3. The method of claim 2 , further comprising a subscriber media service authorization associated with the access point different from a subscriber associated with the user equipment.   The method of claim 1, further comprising associating the media service authorization with a subscriber associated with the user equipment.   Further comprising the step of configuring the trust authentication information as a cookie stored on a computer readable medium of the user device, wherein the client application is not trusted without requesting user name and password authentication. The method of claim 1 including providing the cookie to the client application via the trusted first access point before attempting zero sign-on access to a media service via two access points. .   Further comprising the step of configuring the trusted authentication information as a certificate stored on a computer readable medium of the user device, following authentication of a username and password, the client application is the second untrusted The method of claim 1 including providing the certificate to the client application via the trusted first access point prior to attempting zero sign-on access to a media service via the access point. .   The media service defined for the trust authentication information is provided to the user device so that the trust authentication information is provided to the user device as part of a provisioning step that occurs via the first access point. Before allowing access through the second access point, wherein the user equipment attempts zero sign-on access through the second access point to the media service defined for the trusted authentication information The method of claim 1, further comprising: providing the trusted authentication information to the user equipment via the first access point prior to the step. Depending on whether the Internet Protocol (IP) address specified in the first request assigned to the user equipment is within the trusted domain of the service provider streaming the first television program, The method of claim 1 , further comprising determining whether the third access point is trusted or untrusted.

Images